Weitere ähnliche Inhalte Ähnlich wie Secure your Android app- fight the leaks! (20) Kürzlich hochgeladen (20) Secure your Android app- fight the leaks!2. EYAL LEZMY
ANDROID PRESALES ENGINEER, SAMSUNG B2B
TREASURER AT PARIS ANDROID USER GROUP
ANDROID GOOGLE DEVELOPER EXPERT
Slides
http://bit.ly/droidcon-sec
http://eyal.fr
4. APPS HAVE TO RESPECT THE DATA
Different ways to unintentionally grant other apps access to the
data inside your application :
Exporting an unprotected component
Storing personal data in a world readable file
Logging personal data in logcat logs
Copyright © 1995-2012 SAMSUNG All rights reserved
5. CHECK YOUR ANDROIDMANIFEST.XML
It declares accessible app components
Activity, Service, Receive,...
Adding <intent-filter>
=> your element is exported by default
ContentProvider is always exported by default,
until android:targetSdkVersion="17"
Copyright © 1995-2012 SAMSUNG All rights reserved
6. CHECK YOUR ANDROIDMANIFEST.XML
Don't export app components unless you want to share their
content with other applications
<application android:label="@string/app_name">
…
<service android:name=".ServiceExample“
android:exported="false">
<intent-filter>
…
</intent-filter>
</service>
…
</application>
Copyright © 1995-2012 SAMSUNG All rights reserved
7. CHECK YOUR ANDROIDMANIFEST.XML
Don't export app components unless you want to share their
content with other applications
to
<application android:label="@string/app_name">
ity
itim
…
leg a?
<service android:name=".ServiceExample“
ur at
yo e d
android:exported="false">
t is pos
<intent-filter>
ha ex
… W
</intent-filter>
</service>
…
</application>
Copyright © 1995-2012 SAMSUNG All rights reserved
8. PERMISIONS
There are different permission protection levels:
normal
Lower risk permission
dangerous
Higher risk, access to user private data,
potential negative impact
signature
Needs the same certificate signature
Copyright © 1995-2012 SAMSUNG All rights reserved
9. PERMISIONS
Lets look at the code:
<permission android:name="com.example.EXAMPLE_PERM“
android:label="@string/example_perm_l“
android:description="@string/example_perm_d“
android:icon="@drawable/example_perm_i“
android:protectionLevel="signature" />
...
<service android:name=".ServiceExample“
android:permission="com.example.EXAMPLE_PERM">
<intent-filter>...</intent-filter>
</service>
Copyright © 1995-2012 SAMSUNG All rights reserved
10. PERMISIONS
Don't be the weakest link
Always check the permission of a caller if you use your permission
private boolean checkPermission(Context context)
{
String permission = "com.example.EXAMPLE_PERM";
int res = context.checkCallingPermission(permission);
return (res == PackageManager.PERMISSION_GRANTED);
}
Copyright © 1995-2012 SAMSUNG All rights reserved
11. DISABLE USELESS ACTIVITIES
Fit your components lifecycle to your application's lifecycle
If before configuration (login, account creation, ...) a service or
activity is not useful, disable it
If your application handles common implicit Intent's actions like
ACTION_VIEW or ACTION_SEND consider disabling it by default
Copyright © 1995-2012 SAMSUNG All rights reserved
13. STORING DATA WISELY
Protect personal data using MODE_PRIVATE for data files,
shared preferences, and databases:
openFileOutput()
openSharedPreferences()
openOrCreateDatabase()
External storage (sdcard) is shared storage
Copyright © 1995-2012 SAMSUNG All rights reserved
14. PLEASE... SHUT THE FUCK UP!
Don't expose data through logcat on production
Detect the build mode with BuildConfig.DEBUG
public static final boolean SHOW_LOG = BuildConfig.DEBUG;
public static void d(final String tag, final String msg) {
if (SHOW_LOG)
Log.d(tag, msg);
}
Be careful about this subject and test it during QA
Copyright © 1995-2012 SAMSUNG All rights reserved
15. PROTECTING APP FROM USERS
No more android:debuggable on the manifest
Don't leave this enabled in release code!
ADT 8.0+ do it for you automatically
Copyright © 1995-2012 SAMSUNG All rights reserved
16. PROTECTING APP FROM USERS
$ adb shell
shell@android:/ $ run-as com.android.example sh
shell@android:/data/data/com.android.example $ id
uid=10060(app_60) gid=10060(app_60)
shell@android:/data/data/com.android.example $ ls
files/secret_data.txt
shell@android:/data/data/com.android.example $
cat files/secret_data.txt
Copyright © 1995-2012 SAMSUNG All rights reserved
17. IT'S NOT JUST ABOUT YOUR APP
INSECURE NETWORK
LOST OR STOLEN DEVICES
18. USE SAFE NETWORKING
HTTPS and SSL can protect against Man in the Middle attacks and
prevent casual snooping
Server certificate validity must be correctly checked
"15% of apps have weak or bad SSL implementation on the Play Store"
Free certified SSL: https://www.startssl.com/
Copyright © 1995-2012 SAMSUNG All rights reserved
19. DATA ENCRYPTION DOESN'T SOLVE ALL PROBLEMS
...but it may help discouraging curious.
Use a peer-reviewed library like KeyCzar
Take care of the key :
Create it at first start, with true random
Or grab a user key from your server
Or ask the user for a passphrase you won't store
Copyright © 1995-2012 SAMSUNG All rights reserved
20. DEVICE ADMINISTRATION
On a corporate environment, device administration can be
considered
Password management
Device encryption
Disable camera
Lock the device
Remote wipe
Copyright © 1995-2012 SAMSUNG All rights reserved
21. BEHIND THE STAGE
The APK's content is always world readable, take care about
what you put inside
Sensitive files should be kept out of the APK
Java is open source, your code too
Using Proguard takes a single line of code
Or...
Dex encryption
AAPT modified
Logic on server
Copyright © 1995-2012 SAMSUNG All rights reserved
24. NEVER FORGET THE USER, NEVAAAAA!
"The more secure you make something,
the less secure it becomes"
Level the security following the user acceptance or...
Users will find workarounds
Users won't use your service
Copyright © 1995-2012 SAMSUNG All rights reserved
25. REFERENCES
Google I/O 2012 Sessions
Android Developpers Live Youtube channel
Android Developement
Android Developement: Using Cryptography
The Commons Blog
InformationWeek: Security Paradox
ThreatPost: SLL implementation on Android apps
StartSSL Free certificates
Copyright © 1995-2012 SAMSUNG All rights reserved
26. SAMSUNG SMART APP CHALLENGE 2013
SAMSUNG SMART APP CHALLENGE 2013
A Global app challenge
Apps for the Galaxy S4
Use of Samsung Chord SDK
Apply June 20 - August 31
$800,000 for 10 winners
www.smartappchallenge.com
27. SAMSUNG DEVELOPERS
http://developer.samsung.com
SDKs and Documentation
Samsung Chord SDK
Bluetooth Low Energy SDK
S Pen & Multi Window SDK
AllShare Framework
Remote Test Lab
Test your applications on real devices through the internet
Free
24H 365 Days
Real Device,
NOT emulator
Multiple
Devices